Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teenager facing prison for downloading unsecured files from government website

cbc.ca

Post reply on HN
Print view View original

151–160 of 502 posts

Re: Teenager facing prison for downloading unsecured files from government website

#151

Post by hug »

rayiner wrote: post #124
freshmint wrote: post #21

Earlier quoted context omitted.

I already play with urls that have possible id's in them out of habit. The only difference here is the poor kid was on a gov website and they did not want the information he found to be public. ( Or like in the USA he might have to pay for each document accessed. But I feel that should not result in a raid to his house.) It is a shame the kid was their target and not a google bot like you said.

> I already play with urls that have possible id's in them out of habit Do you jiggle door handles out of habit to see if they're unlocked? It's antisocial behavior. If you were supposed to have access to that document, it would be accessible from a link or search box on the main site.

Poor analogy. What he was doing (incrementing an ID to access a series of files) is more like leafing his way through a filing cabinet. A filing cabinet that was ostensibly filled with public-access files, and he was told he was allowed to be in the filing cabinet.

So while going to the filing cabinet to get the file he'd been directed to, he leafed through other files too. Why not? They're all public information, since they're sitting here in the unlocked filing cabinet with all of the other public information files.

Turns out some of them were mislabeled, and were private information in the public information filing cabinet.

Not so weird, not so antisocial, not his fault, shouldn't be his problem.

Re: Teenager facing prison for downloading unsecured files from government website

#153

Post by rayiner »

jessaustin wrote: post #136
rayiner wrote: post #108

Earlier quoted context omitted.

The "older generation" does not use metaphors because they are limited in their thinking. They do it to illustrate the principles underlying law. A basic principle of private property is that you don't have to secure it. The burden is on the would-be trespasser to figure out what rights she has with respect to the property and act accordingly. Snooping around private property out of "curiosity" is illegal, whether or…

A consideration of real property illustrates nothing about URLs. Speech is a much more apt comparison, in that one host says one thing, and then another, if it freely chooses to do so, responds by saying something else. (In Canada, though, the speech comparison might not help much?) This comparison is much more cogent than anything involving a "trespasser". Of course, authoritarians prefer the stupid comparison.

Computers are dumb pieces of property. They are not capable of speech (though people might use them for speech), nor are they capable of "choos[ing]" to do anything. Analogies that anthropomorphize computers are nonsensical.

The only people here are the teenager and the property owner. And the intent that matters is the intent of the property owner. Did the property owner intend those documents to be publicly accessible? Would a reasonable person have assumed that those documents were not intended to be publicly accessible, because they could only be accessed by editing a URL?

Re: Teenager facing prison for downloading unsecured files from government website

#154

Post by jessaustin »

mr_toad wrote: post #106
politician wrote: post #18

Add "help avoid sending teenagers to prison" to the list of reasons why you should prefer UUIDs over integers in your Internet-facing REST API. This API was supposed to be private and yet supported trivial enumeration?

UUID are easily shared, and there is no way of knowing who shared it. Good for Xmas photos, not so good for sensitive documents.

You could just keep a record of to whom you gave each UUID?

Re: Teenager facing prison for downloading unsecured files from government website

#155

Post by jopsen »

Declanomous wrote: post #126
ljm wrote: post #90

Earlier quoted context omitted.

It feels like the reduction of a nuanced problem into a simple one with a single victim and a single perpetrator, and only one acceptable narrative. "It's not my fault I left my window open and you took advantage of it. I shouldn't have to keep my windows locked." "If you see an unlocked window it's not an opportunity for you to take advantage of." That's admittedly fairly obtuse, but you can see elements of this pla…

It's not necessarily a problem that the older generation can only think about technology in a metaphorical sense, the problem is that the metaphors they are using are idiotic. I think, by and large, people are constrained to thinking about things they can describe. To that extent, being able to accurately describe something is meaningful, and is therefore a linguistic issue. Semantics are very important when you are…

No OP has a point, we shouldn't talk in metaphors so much... It's not necessary.

The web is in many ways a huge collection of resources that reference each other. Some of these references are explicit in links, others in text, and some are available for programmatic access.

In fact many resources can be discovered by programmatic access, and there is no inherent reason to think this is wrong. Just because an API isn't documented doesn't make using it illegal.

For example, many URLs are actually permalinks, you can bookmark them, or send them to a friend. While most websites don't document this API, it's very common.

Lots of people configure search keywords in Firefox by injecting queries in bookmarked URLs. Few of these URL patterns are formally documented, but that doesn't make their usage illegal.

Re: Teenager facing prison for downloading unsecured files from government website

#156

Post by jolmg »

rayiner wrote: post #116
EpicEng wrote: post #101

Earlier quoted context omitted.

>I don't lock my car, and often not my house either. I don't think that means you should be able to snoop around and see what interests you. Websites are private property Here's a better analogy; you put up a "yard sale" sign in your front yard, fill the driveway with property, and then call the police on the first person who shows up claiming they are trespassing.

When you put up a "yard sale" sign, you're conveying what is called an "implied license" to access the property. The scope of a trespasser's right to access a property is limited to what a reasonable person would consider to be granted by the license. A reasonable person would assume that a "yard sale" sign grants a license to access the yard on which the sign is posted, but not to go around to the back yard and peek…

If a url is not supposed to be edited by people, address bars wouldn't be text fields. It wasn't long ago that one of the primary ways of going to a website or even a particular webpage was entering it manually in the address bar as opposed to going to google first.

Websites are not only meant to be accessed by humans either. Are you telling me that bots should employ human reason to guess what should be viewed or not?

I'm not even sure what you're proposing. The web has always been public space.

If a website puts a link to a resource that is not protected by authentication means, and hides it behind some other html element, or styles it with javascript to a white font on a white background, or does something else that is similarly difficult for a script to guess is not viewable by humans on some subset of browsers, is it now breaking the law because obviously the url was not viewable on any webpage?

How about if someone takes the url, and doesn't view it, but posts it on some other website with high traffic. Now all people that click the link have broken the law?

Re: Teenager facing prison for downloading unsecured files from government website

#157

Post by greedo »

daodedickinson wrote: post #24
bowmessage wrote: post #9

Really worried about what the authorities might find in his 30TB of 4chan backups. Hoping for the best outcome for them.

Exactly. Why did this kid admit that? How astronomcally low are the odds there's nothing illegal to possess in there?

If one would give me six lines written by the hand of the most honest man, I would find something in them to have him hanged.

Re: Teenager facing prison for downloading unsecured files from government website

#158

Post by jessaustin »

amatecha wrote: post #42
isostatic wrote: post #12

I wonder how they noticed. Perhaps the lowest-bid contract company that made the site decided to use something like amazon glacier for storage of boring documents nobody will ever need. Then along comes someone that causes them all to be extracted at great cost, some middle manager receives a bill for $millions and wants to blame the kid rather than his own failings.

The truth is even sadder than you might expect (the rest of this post is a quote from this article[0]): Conrad said the breach was detected by a provincial employee, but it was a fluke. “The employee was involved in doing some research on the site and inadvertently made an entry to a line on the site — made a typing error and identified that they were seeing documents they should not have seen,” Conrad told a technic…

There's a bit of a leap from that to knowing this dude had done the same thing? That describes the employee finding a vulnerability. It probably took some study of the logs to find "the breach". How many similar breaches by actors overseas and less-vulnerable Canadians did they ignore?

Re: Teenager facing prison for downloading unsecured files from government website

#160

Post by loup-vaillant »

rayiner wrote: post #116
EpicEng wrote: post #101

Earlier quoted context omitted.

>I don't lock my car, and often not my house either. I don't think that means you should be able to snoop around and see what interests you. Websites are private property Here's a better analogy; you put up a "yard sale" sign in your front yard, fill the driveway with property, and then call the police on the first person who shows up claiming they are trespassing.

When you put up a "yard sale" sign, you're conveying what is called an "implied license" to access the property. The scope of a trespasser's right to access a property is limited to what a reasonable person would consider to be granted by the license. A reasonable person would assume that a "yard sale" sign grants a license to access the yard on which the sign is posted, but not to go around to the back yard and peek…

> A reasonable person would not assume that content you can only get to by editing a URL manually is supposed to be accessible to the public.

A reasonable person could totally use crawlers like DownThemAll, and fail to notice that some URLs they request are not, in fact, accessible by clicking through a web page. That's different from accessing something you know isn't accessible by mainstream means.

I did that several time to download some porn. The process is simple: search for whatever I'm interested in in a search engine, click on whatever image looks interesting, see if I the URL has numbers I can modify to access nearby images (they will have hopefully the same theme, or even depict the same scene).

The first URL was clearly publicly available. I got it legitimately through a search engine, or by clicking around. How am I supposed to guess that some of the others are off limits?

Post reply on HN